microsoft / microsoft/AttackSurfaceAnalyzer
Exclude Volatile Registry Keys
Nobody has claimed this yet.
- Dominant language
- C#
- Stars
- 3k
- Forks
- 294
- PR merge metrics
- No merged PRs in 30d
Description
The .NET Core RegistryKey takes RegistryOptions when creating a key but does not expose the options when you open a key. Volatile keys don't persist across reboots, so they should be considered pretty low importance. We should at least tag keys which are volatile for use in analysis, if not exclude them entirely (perhaps with option)
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the code that opens .NET Core RegistryKey instances and review how RegistryOptions and volatile keys are currently handled. The issue does not name a file or test, and completion depends on deciding between tagging volatile keys for analysis and providing an exclusion option; verify the chosen behavior in the relevant registry-analysis coverage.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- operating-systems, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100